Repository navigation
Labels without escaping - #202
Conversation
escaped option to skip HTML escaping on labels
lippserd
left a comment
There was a problem hiding this comment.
Please address the following before merging.
Please update the public label contract to include ValidHtml. LabelDecorator and the new test accept it, but FormElement::getLabel() and BaseFormElement::$label/setLabel() still advertise strings, so PHPStan considers the new branch impossible and statically checked callers cannot use the feature. Document that strings are escaped while ValidHtml is trusted markup.
Please apply the same ValidHtml pass-through to fieldset legends. Fieldsets bypass LabelDecorator, and FieldsetDecorator still wraps every label with Text::create(); browser verification showed HtmlString markup being escaped, while a render-only ValidHtml implementation fails during string conversion. Add coverage for string, HtmlString, and render-only ValidHtml labels.
Please update the PR description to match the final design. It still promises the removed escaped option and accessors, while the current diff uses automatic ValidHtml detection.
|
I extended |
lippserd
left a comment
There was a problem hiding this comment.
In addition to the requested changes:
SubmitElement::setLabel() with no @param annotation inherits the widened ValidHtml contract but its pipeline is string-only. A caller who passes a ValidHtml object based on the advertised interface will silently break form submission detection: hasBeenPressed() compares the stored object against a string with ===, which is always false for objects. Add a narrowing @param string $label annotation to SubmitElement::setLabel(). A brief docblock sentence explaining that the label populates a value attribute and must therefore be a plain string is sufficient.
I am not fully aware of the deprecated DivDecorator usage but its fieldset path throws TypeError for non-Stringable ValidHtml. I would apply the same guard used in FieldsetDecorator: replace Text::create($label) with $label instanceof ValidHtml ? $label : new Text($label).
|
Narrowed the type via |
367741e to
62ca031
Compare
lippserd
left a comment
There was a problem hiding this comment.
Please clean up the commit history.
27cc91d to
cb4f4fa
Compare
|
Commit history is clean now. |
Previously all labels were wrapped in `Text`, which HTML-escapes the content even when the caller passed a pre-rendered `ValidHtml` object. Plain strings are still escaped. `ValidHtml` instances are now passed through directly.
`SubmitElement::setLabel()` keeps a `string`-only override: the label populates the `value` attribute and must match the submitted form value, so it cannot be a `ValidHtml` object.
`LabelDecorator` already handles `ValidHtml` labels by using them as-is and only wrapping plain strings in `Text`. `FieldsetDecorator` was calling `Text::create()` unconditionally, which coerces the label to string via `setContent()`, breaking any `ValidHtml` implementation that does not also implement `__toString()`.
Wrapping the label in `Text` cast it to a string first. A fieldset legend therefore raised `Object of class X could not be converted to string` for any `ValidHtml` label lacking `__toString()`, and rendered the markup of the stringable ones literally. The label branch never had this problem because `Html::tag()` passes `ValidHtml` content through on its own.
cb4f4fa to
9d4869d
Compare
LabelDecoratorandFieldsetDecoratorpreviously wrapped every label inText, which HTML-escapes its content on render. Passing aValidHtmllabel therefore caused its markup to be double-escaped, and passing anyValidHtmlthat does not implement__toString()caused a fatal error during the string coercion inText::setContent().Both decorators now detect
ValidHtmllabels and use them directly, wrapping only plain strings inText.FieldsetDecoratorrequires its own fix because fieldset elements bypassLabelDecoratorentirely and render the legend themselves.The
$labelproperty,setLabel(), andgetLabel()type annotations are updated to reflect that labels may be either a plain string or aValidHtmlobject.Tests cover string escaping,
HtmlStringpass-through, and a render-onlyValidHtmlimplementation (no__toString()) for both decorators.